Stefan Hallerstede On the Purpose of Event-B Proof Obligations. 125-138 2008 ABZ http://dx.doi.org/10.1007/978-3-540-87603-8_11 conf/asm/2008 db/conf/asm/abz2008.html#Hallerstede08